[do not merge] hack: local verification script for IPv6-only DNS - #1043
Draft
Yuan Gao (ygao-g) wants to merge 2 commits into
Draft
[do not merge] hack: local verification script for IPv6-only DNS#1043Yuan Gao (ygao-g) wants to merge 2 commits into
Yuan Gao (ygao-g) wants to merge 2 commits into
Conversation
CoreDNS runs dnsPolicy: Default and inherits the node's Docker-generated /etc/resolv.conf, which always names an IPv4 resolver -- unreachable from a v6-only pod, so every external lookup SERVFAILs and anything that fetches at runtime never starts. Behind that sits a second failure: the registry is wired into containerd on the node, but atelet pulls actor images from its own pod netns, where kind-registry does not resolve at all. On IPv6-only clusters CoreDNS now answers for kind-registry and forwards everything else to an IPv6 upstream, overridable with IPV6_DNS_UPSTREAM where the default is unreachable. A pod resolves external names and reaches the registry, so the control plane installs and actors boot. IPv4 and dual-stack clusters are unchanged.
Nothing exercised the IPv6-only CoreDNS rewrite except building a cluster and watching what happened, so a transform that quietly stopped matching kind's default Corefile would still have looked like a pass. The rewrite now lives in a sourceable function, and hack/verify-ipv6-dns.sh runs it against a pinned copy of that Corefile with neither Docker nor a cluster, then -- given a cluster -- asserts the shape that landed and resolves from a pod rather than the node, which is dual-stack and answers either way. Two of the offline checks are controls that must fail: an unrecognised Corefile, and re-patching an already-patched one. Reference branch stacked on the DNS fix, not a merge candidate.
Yuan Gao (ygao-g)
force-pushed
the
kind-ipv6-coredns-verify
branch
from
August 18, 2026 20:19
af509a2 to
f4fcece
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Not a merge candidate — please don't merge this. It exists so anyone looking at #958 can reproduce that PR's local testing without hand-building a harness. Stacked on #958: the first commit is that PR's, only the second is new here.
hack/verify-ipv6-dns.shchecks the CoreDNS rewrite that IPv6-only kind clusters need. The offline half runs the transform against a pinned copy of kind's default Corefile and needs neither Docker nor a cluster. The live half detects the cluster's address family, asserts ipv4 and dual-stack are left alone, and probes from a pod rather than the node — the node is dual-stack and answers either way, so a node-side probe proves nothing.Two of the offline checks are controls that must fail, so a transform that silently did nothing cannot pass. Locally: 9/9 offline, 11/11 against an IPv4 cluster, 14/14 against a fresh IPv6-only one.
To make the transform testable without a cluster it moved into a sourceable function;
create-kind-cluster.shbehaviour is unchanged.🤖 Generated with Claude Code